1 min Reading Time<\/p>\n
A utility company with 900 employees achieved NIS2 readiness in 6 months — with a limited budget and without external consulting firms. The key: consistent use of existing frameworks as a basis.<\/strong><\/p>\n A utility company with 900 employees achieved NIS2 readiness in 6 months – with a limited budget and without external consulting firms. The key: consistent use of existing frameworks (ISO 27001, BSI IT-Grundschutz) as a basis and focusing on actual gaps rather than complete rebuilding.<\/p>\n The utility company supplies a major city with electricity, gas, water, and district heating. As a KRITIS operator, an ISMS according to ISO 27001 was already implemented. However, the NIS2 gap analysis revealed significant gaps:<\/p>\n Month 1-2: Reporting Process<\/strong><\/p>\n Month 2-3: Supply-Chain Security<\/strong><\/p>\n Month 3-4: Management and Governance<\/strong><\/p>\n Month 4-5: OT Security Integration<\/strong><\/p>\n Month 5-6: Testing and Documentation<\/strong><\/p>\n Total costs: approx. 95,000 EUR<\/p>\n Industry:<\/strong> Energy supply \/ utility company (KRITIS)<\/p>\n Starting Point:<\/strong> ISO 27001 certified<\/p>\n NIS2 Readiness Achieved in 6 Months<\/strong><\/p>\n Total Budget:<\/strong> 95,000 EUR (without external consultants)<\/p>\n Highest Effort:<\/strong> Supply-chain inventory (127 suppliers)<\/p>\n Fact:<\/strong> The BSI (Federal Office for Information Security) counts over 1,500 utility companies and municipal suppliers in Germany, the majority of which fall under the KRITIS regulation.<\/p>\n Fact:<\/strong> According to ENISA, municipal infrastructures were the third most frequent target of attacks in the EU in 2024 – after the healthcare and financial sectors.<\/p>\n Every question is locked. A tap unlocks the answer.<\/p>\n Yes, if a solid foundation exists (e.g., ISO 27001). The key lies in a structured gap analysis and focusing on actual gaps rather than complete rebuilding.<\/p>\n<\/details>\n Experience shows that supply-chain security does: inventorying all IT service providers and software suppliers, risk assessment, and contractual safeguards are time-consuming but essential.<\/p>\n<\/details>\n Utility companies often operate heterogeneous IT and OT landscapes with established structures. Many systems date back to a time before modern security standards. Additionally, limited IT budgets and a shortage of skilled workers in municipal operations make NIS2 implementation particularly demanding.<\/p>\n<\/details>\n NIS2 Directive: What Companies Need to Know<\/a><\/p>\n Cyber Insurance 2026<\/a><\/p>\n Zero Trust: The 7 Most Common Mistakes<\/a><\/p>\n More from the MBF Media Network<\/p>\nTL;DR<\/h2>\n
Initial Situation<\/h2>\n
\n
The 6-Month Plan<\/h2>\n
\n
\n
\n
\n
\n
Budget<\/h2>\n
\n
Key Facts<\/h2>\n
Frequently Asked Questions<\/h2>\n
Can NIS2 readiness be achieved without external consultants?<\/strong><\/summary>\n
Which NIS2 requirement causes the most effort?<\/strong><\/summary>\n
What special challenges do utility companies face in NIS2 implementation?<\/strong><\/summary>\n
Further Articles<\/h2>\n
Related Articles<\/h2>\n
\n